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REMARKS 

Claim 3 has been cancelled. Claims 1, 4, 22, and 23 have been amended to clarify the 
subject matter regarded as the invention. Claims 1, 2, and 4-23 remain pending. The 
specification has been amended to overcome the Examiner's objection. 

The Examiner has rejected claims 1-23 under 35 USC 102(b). 

The rejection is respectfully traversed. With respect to claim 1, Maloney discloses a 
system for analyzing security information in which a data discovery tool writes data into flat 
(e.g., text) files and a separate data parser uses key word searches to organize the data in a way 
that enables an analytical engine to read and use the data. Maloney at col. 4, lines 34-41; col. 5, 
lines 24-33; col. 6, lines 45-62; col. 9, line 65 - col. 10, line 6; col. 10, line 63 - col. 11, line 5; 
and Figures 1 & 2. 

Claim 1 recites a sensor that communicates with an analysis engine using a meta-protocol 
"under which a 4-tuple is used to represent a data item to be sent to the analysis engine for 
analysis; wherein the 4-tuple represents the data item in a manner that enables the analysis 
engine to receive and use the data item regardless of how the data item is represented and 
organized on a platform associated with the sensor." See, e.g., Application at p. 31, line 1 - p. 
43, line 15. 

Maloney does not describe any "4-tuple" as recited in claim 1 . Instead, Maloney teaches 
sending and storing data in the form of raw data and/or flat (text) files. See, e.g., Maloney at col. 
5, lines 24-32; col. 7, lines 19-26; and Fig. 2. Note that the reference to Maloney at col. 2, lines 
48-50, is to "deriving a genetic structure" of a virus or other malicious program to be used to 
identify malicious files or programs that match the "genetic" signature of the virus, not a 
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"generic structure" for representing data as suggested in the Office Action at p. 3. The cited 
portion of Maloney does not describe using a 4-tuple used to represent a data item sent by a 
sensor to an analysis engine. As such, claim 1 is believed to be allowable. 

Claims 2 and 4-21 depend from claim 1 and are believed to be allowable for the same 
reasons described above. 

Similarly to claim 1, claim 22 recites, "the 4-tuple represents a data item to be sent to the 
analysis engine for analysis in a manner that enables the analysis engine to receive and use the 
data item regardless of how the data item is represented and organized on a platform associated 
with the sensor." 

Like claim 22, claim 23 recites, "the 4-tuple represents a data item to be sent to the 
analysis engine for analysis in a manner that enables the analysis engine to receive and use the 
data item regardless of how the data item is represented and organized on a platform associated 
with the sensor." 

Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 
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